RRSIG rsync.gentoo.org/SOA alg 5, id 50775: The cryptographic signature of the RRSIG RR does not properly validate. See RFC 4035, Sec. 5.3.3.
gentoo.org to rsync.gentoo.org: No valid RRSIGs made by a key corresponding to a DS RR were found covering the DNSKEY RRset, resulting in no secure entry point (SEP) into the zone. See RFC 4035, Sec. 2.2, RFC 6840, Sec. 5.11. (65.98.29.106, 140.211.166.189, 154.52.129.30, 176.119.25.15, 2001:470:1f06:a91::2, 2001:470:1f13:1279:ae16:2dff:fe72:f4e8, 2001:470:ea4a:1:225:90ff:fe02:16e5, 2001:470:ea4a:1:a800:ff:fe3a:8870, 2a09:2dc0:0:14:225:90ff:fe63:3bc0, TCP_-_EDNS0_4096_D_N, UDP_-_EDNS0_4096_D_KN, UDP_-_EDNS0_512_D_KN)
gentoo.org to rsync.gentoo.org: The DS RRset for the zone included algorithm 5 (RSASHA1), but no DS RR matched a DNSKEY with algorithm 5 that signs the zone's DNSKEY RRset. See RFC 4035, Sec. 2.2, RFC 6840, Sec. 5.11. (65.98.29.106, 140.211.166.189, 154.52.129.30, 176.119.25.15, 2001:470:1f06:a91::2, 2001:470:1f13:1279:ae16:2dff:fe72:f4e8, 2001:470:ea4a:1:225:90ff:fe02:16e5, 2001:470:ea4a:1:a800:ff:fe3a:8870, 2a09:2dc0:0:14:225:90ff:fe63:3bc0, TCP_-_EDNS0_4096_D_N, UDP_-_EDNS0_4096_D_KN, UDP_-_EDNS0_512_D_KN)
rsync.gentoo.org/DNSKEY (alg 5, id 37372): No RRSIG covering the RRset was returned in the response. See RFC 4035, Sec. 3.1.1. (65.98.29.106, 140.211.166.189, 154.52.129.30, 176.119.25.15, 2001:470:1f06:a91::2, 2001:470:1f13:1279:ae16:2dff:fe72:f4e8, 2001:470:ea4a:1:225:90ff:fe02:16e5, 2001:470:ea4a:1:a800:ff:fe3a:8870, 2a09:2dc0:0:14:225:90ff:fe63:3bc0, TCP_-_EDNS0_4096_D_N, UDP_-_EDNS0_4096_D_KN, UDP_-_EDNS0_512_D_KN)
rsync.gentoo.org/DNSKEY (alg 5, id 50775): No RRSIG covering the RRset was returned in the response. See RFC 4035, Sec. 3.1.1. (65.98.29.106, 140.211.166.189, 154.52.129.30, 176.119.25.15, 2001:470:1f06:a91::2, 2001:470:1f13:1279:ae16:2dff:fe72:f4e8, 2001:470:ea4a:1:225:90ff:fe02:16e5, 2001:470:ea4a:1:a800:ff:fe3a:8870, 2a09:2dc0:0:14:225:90ff:fe63:3bc0, TCP_-_EDNS0_4096_D_N, UDP_-_EDNS0_4096_D_KN, UDP_-_EDNS0_512_D_KN)
rsync.gentoo.org/TXT has errors; select the "Denial of existence" DNSSEC option to see them.
rsync.gentoo.org/MX has errors; select the "Denial of existence" DNSSEC option to see them.
rsync.gentoo.org/DNSKEY has errors; select the "Denial of existence" DNSSEC option to see them.
k3uvb56nda.rsync.gentoo.org/A has errors; select the "Denial of existence" DNSSEC option to see them.
rsync.gentoo.org/CNAME has errors; select the "Denial of existence" DNSSEC option to see them.
Warnings (29)
RRSIG gentoo.org/DNSKEY alg 5, id 46873: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
RRSIG gentoo.org/DNSKEY alg 5, id 46873: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
RRSIG gentoo.org/DNSKEY alg 5, id 52980: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
RRSIG gentoo.org/DNSKEY alg 5, id 52980: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
RRSIG rsync.gentoo.org/A alg 5, id 50775: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
RRSIG rsync.gentoo.org/AAAA alg 5, id 50775: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
RRSIG rsync.gentoo.org/DS alg 5, id 52980: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
RRSIG rsync.gentoo.org/DS alg 5, id 52980: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
RRSIG rsync.gentoo.org/NS alg 5, id 50775: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
RRSIG rsync.gentoo.org/SOA alg 5, id 50775: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
org to gentoo.org: The glue address(es) for ns1.gentoo.org (2001:470:ea4a:1:225:90ff:fe02:16e5, 2001:470:ea4a:1:a800:ff:fe3a:8870) differed from its authoritative address(es) (2001:470:ea4a:1:225:90ff:fe02:16e5). See RFC 1034, Sec. 4.2.2.
rsync.gentoo.org/DNSKEY (alg 5, id 37372): No response was received from the server over UDP (tried 6 times) until the COOKIE EDNS option was removed (however, this server appeared to respond legitimately to other queries with the COOKIE EDNS option present). See RFC 6891, Sec. 6.1.2. (2a09:2dc0:0:14:225:90ff:fe63:3bc0, UDP_-_EDNS0_4096_D_KN)
rsync.gentoo.org/DNSKEY (alg 5, id 50775): No response was received from the server over UDP (tried 6 times) until the COOKIE EDNS option was removed (however, this server appeared to respond legitimately to other queries with the COOKIE EDNS option present). See RFC 6891, Sec. 6.1.2. (2a09:2dc0:0:14:225:90ff:fe63:3bc0, UDP_-_EDNS0_4096_D_KN)
rsync.gentoo.org/DS (alg 5, id 37372): DNSSEC implementers are prohibited from implementing signing with DS algorithm 1 (SHA-1). See RFC 8624, Sec. 3.2.
rsync.gentoo.org/DS (alg 5, id 37372): DNSSEC implementers are prohibited from implementing signing with DS algorithm 1 (SHA-1). See RFC 8624, Sec. 3.2.
rsync.gentoo.org/DS (alg 5, id 37372): DS records with digest type 1 (SHA-1) are ignored when DS records with digest type 2 (SHA-256) exist in the same RRset. See RFC 4509, Sec. 3.
rsync.gentoo.org/DS (alg 5, id 37372): DS records with digest type 1 (SHA-1) are ignored when DS records with digest type 2 (SHA-256) exist in the same RRset. See RFC 4509, Sec. 3.
rsync.gentoo.org/DS (alg 5, id 37372): No response was received from the server over UDP (tried 6 times) until the COOKIE EDNS option was removed (however, this server appeared to respond legitimately to other queries with the COOKIE EDNS option present). See RFC 6891, Sec. 6.1.2. (2a09:2dc0:0:14:225:90ff:fe63:3bc0, UDP_-_EDNS0_4096_D_KN)
rsync.gentoo.org/DS (alg 5, id 37372): No response was received from the server over UDP (tried 6 times) until the COOKIE EDNS option was removed (however, this server appeared to respond legitimately to other queries with the COOKIE EDNS option present). See RFC 6891, Sec. 6.1.2. (2a09:2dc0:0:14:225:90ff:fe63:3bc0, UDP_-_EDNS0_4096_D_KN)
rsync.gentoo.org/DS (alg 5, id 37372): No response was received from the server over UDP (tried 6 times) until the COOKIE EDNS option was removed (however, this server appeared to respond legitimately to other queries with the COOKIE EDNS option present). See RFC 6891, Sec. 6.1.2. (2a09:2dc0:0:14:225:90ff:fe63:3bc0, UDP_-_EDNS0_4096_D_KN)
rsync.gentoo.org/DS (alg 5, id 37372): No response was received from the server over UDP (tried 6 times) until the COOKIE EDNS option was removed (however, this server appeared to respond legitimately to other queries with the COOKIE EDNS option present). See RFC 6891, Sec. 6.1.2. (2a09:2dc0:0:14:225:90ff:fe63:3bc0, UDP_-_EDNS0_4096_D_KN)
rsync.gentoo.org/NS: No response was received from the server over UDP (tried 6 times) until the COOKIE EDNS option was removed (however, this server appeared to respond legitimately to other queries with the COOKIE EDNS option present). See RFC 6891, Sec. 6.1.2. (2a09:2dc0:0:14:225:90ff:fe63:3bc0, UDP_-_EDNS0_4096_D_KN)
rsync.gentoo.org/SOA: No response was received until the UDP payload size was decreased, indicating that the server might be attempting to send a payload that exceeds the path maximum transmission unit (PMTU) size. See RFC 6891, Sec. 6.2.6. (2a09:2dc0:0:14:225:90ff:fe63:3bc0, UDP_-_EDNS0_4096_D_KN)
rsync.gentoo.org/MX has warnings; select the "Denial of existence" DNSSEC option to see them.
rsync.gentoo.org/DS has warnings; select the "Denial of existence" DNSSEC option to see them.
rsync.gentoo.org/DNSKEY has warnings; select the "Denial of existence" DNSSEC option to see them.
k3uvb56nda.rsync.gentoo.org/A has warnings; select the "Denial of existence" DNSSEC option to see them.
rsync.gentoo.org/TXT has warnings; select the "Denial of existence" DNSSEC option to see them.
rsync.gentoo.org/CNAME has warnings; select the "Denial of existence" DNSSEC option to see them.